Card issuance system and process

ABSTRACT

A method of secured card issuance from a card issuing machine, as well as a system for card issuance, that is designed to address many of the security concerns surrounding automated, self-service card issuance. The invention relies upon a combination of measures to enhance the security of the card issuance process. The security measures include tracking and auditing of the cards from a card loading site up to the time of card issuance to the customer, controlling physical access to the cards, and real time reporting and monitoring of card transactions and subsequent inventory changes.

FIELD OF THE INVENTION

[0001] The present invention relates to automated, self-service cardissuing machines that issue cards, such as credit cards, smart cards,debit cards, ATM cards, identification cards, security cards and thelike. More particularly, the present invention relates to processes forenhancing the security of card issuance from automated card issuingmachines.

BACKGROUND OF THE INVENTION

[0002] Personalized cards bearing user specific information, such ascredit cards, are typically issued to a user by sending the cardsthrough the mail. In many areas of the world, the mail systems cannot besufficiently relied upon. Thus, credit cards and other personalizedcards are typically applied for and/or issued at the financialinstitution or other institution issuing the card. This is veryinconvenient for the end user who must personally appear multiple timesat the institution in order to apply for and/or obtain the issued card.

[0003] In addition, there are many instances where it is desirable for auser to be able to readily obtain a replacement card such as when a cardis lost, stolen, damaged and/or destroyed. In many situations, such aswhen traveling, it is very inconvenient for the card holder to have tovisit a financial institution in order to obtain a replacement oradditional cards.

[0004] To resolve these issues, card issuance is evolving towards theuse of automated, self-service card issuance machines to issuepersonalized cards directly to a customer. These card issuance machines,which in many respects operate similarly to an automated teller machine(ATM), allow a customer to select the type of card that is desired, withthe machine then personalizing the card with customer information andsubsequently issuing the card directly to the customer.

[0005] An automated, self-service card issuing machine is disclosed inpublished PCT application WO 92/17856. The card issuing machinedescribed in this document is capable of issuing personalized cards,such as credit cards (i.e. MasterCard®, Visa®, etc.) at an unattendedlocation directly to a customer, with the cards being personalized bythe machine.

[0006] One of the overriding concerns in automated, self-service cardissuing machines is the need for security of the cards that are to beissued by the machine. This is particularly true for machines that issuecredit cards and other high value financial and retail cards, due to thehigh monetary values intrinsic to these types of cards. Thus, the cardsmust be secured against theft or unauthorized access thereto while inthe machine, as well as being secured against theft and unauthorizedaccess thereto while outside of the machine, such as while beingtransported to and from the machine.

[0007] What is needed then is a system and method for addressingsecurity concerns involving the issuance of cards from card issuingmachines.

SUMMARY OF THE INVENTION

[0008] The invention provides a method of secured card issuance from acard issuing machine, as well as a system for card issuance, that isdesigned to address many of the security concerns surrounding automated,self-service card issuance. The invention relies upon a combination ofmeasures to enhance the security of the card issuance process. Thesecurity measures include tracking and auditing of the cards from a cardloading site up to the time of card issuance to the customer,controlling physical access to the cards, and real time reporting andmonitoring of card transactions and subsequent inventory changes.

[0009] In one embodiment in accordance with the invention, a method ofcard issuance from a card issuing machine that receives cards within acontainer from a card loading site, with the card issuing machine andthe card loading site being in communication with a host controller, isprovided. The method comprises: loading the container with cards at thecard loading site; transmitting a loaded card inventory of the loadedcards to the host controller; transporting the loaded container from thecard loading site to the card issuing machine, and loading the containerinto the card issuing machine; determining a received card inventory inthe loaded container; and comparing the received card inventory with theloaded card inventory.

[0010] Since the host controller knows the inventory of the cards loadedinto the container, a comparison of the card inventory after loading atthe card loading site with the card inventory after loading thecontainer into the machine can spot any discrepancies in the cardinventory, thereby indicating a possible theft of cards during transportof the cards to the card issuing machine.

[0011] In accordance with yet another embodiment, a method of cardissuance from a card issuing machine that receives cards within acontainer from a card loading site is provided. The method comprisesloading the container with cards at the card loading site, and storing aloaded card inventory of the loaded cards into memory provided on thecontainer; transporting the loaded container from the card loading siteto the card issuing machine, and loading the container into the cardissuing machine; reading the loaded card inventory from cassette memory;conducting an inventory scan of the cards actually in the container todetermine an actual card inventory; and comparing the read loaded cardinventory with the actual card inventory.

[0012] In accordance with another aspect of the invention, a cardissuance system is provided comprising a card issuing machine having acontainer therein adapted to hold a plurality of cards for issuance bythe card issuing machine. The container includes means for storinginventory information of the cards within the container. The systemfurther includes a card loading site at which the container is loadedwith the cards, and a host controller in communication with the cardissuance machine and the card loading site.

[0013] A variety of additional advantages of the invention will be setforth in part in the description which follows, and in part will beobvious from the description, or may be learned by practice of theinvention. The advantages of the invention will be realized and attainedby means of the elements and combinations particularly pointed out inthe claims. It is to be understood that both the foregoing generaldescription and the following detailed description are exemplary andexplanatory only and are not restrictive of the invention as claimed.

BRIEF DESCRIPTION OF THE DRAWINGS

[0014]FIG. 1 is a block diagram illustrating the card issuance system inaccordance with the principles of the invention.

[0015]FIG. 2A is a perspective view of a cassette in accordance with theinvention, with the cassette being in the closed position.

[0016]FIG. 2B is a perspective view of the cassette in a partially openposition.

[0017]FIG. 3 is perspective view of the inner housing of the cassette,along with a portion of the outer shell.

[0018]FIG. 4 is a side view of the inner housing illustrating itsinteraction with the lock mechanism.

[0019]FIG. 5A is a top perspective view of the inner housing and thelock mechanism.

[0020]FIG. 5B is a top view of an eccentric mechanism for actuating thelocking mechanism.

[0021]FIG. 6 is a perspective view of the outer shell of the cassette.

[0022]FIG. 7 is an electrical schematic showing the electronicsassociated with the cassette.

[0023]FIG. 8 is a block diagram of an embodiment of the card issuanceprocess in accordance with the invention.

[0024]FIG. 9 is a block diagram illustrating an alternate embodiment ofthe card issuance system.

[0025]FIG. 10 is a block diagram of the card issuance process for theembodiment of FIG. 9.

DETAILED DESCRIPTION OF THE INVENTION

[0026] With reference to FIG. 1, in one embodiment, the inventionrelates to a system, and method, for issuing cards, such asfinancial-related cards (e.g. credit cards, smart cards, debit cards,etc.) and/or security cards (e.g. identification cards, access cards,etc.) from an automated, self-service, card issuing machine 5. Cards tobe issued from the machine 5 are provided from a card loading site 6,where the cards are loaded into one or more card cassettes or containerswhich are then transported to, and loaded into, the card issuing machine5 for subsequent issuance of the cards. The card issuing machine 5 andthe card loading site 6 are each in communication with a host controller7 which coordinates the operations of the card issuing machine 5 and thecard loading site 6.

[0027] Communication between the card issuing machine 5 and the hostcontroller 7 and between the card loading site 6 and the host controller7, is preferably implemented through modems and telephone lines. Howeverother methods of communications could be used if desired, such as viawireless communication. In addition, the communications between the cardissuing machine 5 and the host controller 7, and between the cardloading site 6 and the host controller 7, are preferably encrypted usingconventional encryption technology to increase the security of thecommunications. For instance, DES encryption can be used.

[0028] The card issuing machine 5 is an automated unit, similar to anATM, that is capable of selecting a single card from a plurality ofdifferent types of cards provided in a card source, personalizing thecard if necessary, and then issuing the card to the customer based uponthe customer selection. A card issuing machine of this type is disclosedin copending application Ser. No. ______ (Attorney Docket No.2968.187US01), filed on even date herewith, assigned to DataCardCorporation, and which is incorporated herein by reference.

[0029] As described in Ser. No. ______ (Attorney Docket No.2968.187US01), the cards are disposed within a single container orcassette, with each card having its own discrete position therebyallowing any one of the cards to be picked from the container at anytime as well as allowing the card issuing machine to know the exactlocation of each card within the container. The card issuing machine isprovided with a user interface to allow a customer to select the desiredtype of card, with the machine then picking the appropriate card fromthe container and then directing the card to a personalization modulewhere the card is personalized if necessary. After personalization, thecard is directed to a delivery module which delivers the newlypersonalized card to the customer.

[0030] As mentioned previously, the cassette is preferably loaded withcards at the card loading site 6 and then transported to the cardissuing machine 5, where it is loaded into the machine for subsequentissuance of the cards. One of the security concerns surrounding cardissuance from automated card issuance machines is the need to ensure thesecurity of the cards during the time of transport between the cardloading site and the card issuing machine, as well as after thecontainer is loaded into the machine. Thus, the container should bedesigned to prevent unauthorized access to the cards therein, therebypreventing tampering with, and theft of, the cards.

[0031] FIGS. 2-7 illustrate one implementation of a card container orcassette 10 that can be used with the invention for ensuring thesecurity of the cards. In particular, the cassette 10 is designed toallow electronic storage thereon of a unique identification number thatis readable by the machine 5 to ensure that the correct cassette isbeing inserted into the machine. The unique identification number isalso readable by suitable means at the card loading site 6 to ensurethat the correct cassette 10 is being loaded or has been returned fromthe machine 5.

[0032] Further, the cassette 10 includes an electronic lock mechanismassociated therewith for locking the cassette until the cassette isinserted into the machine 5 and the machine releases the electronic lockmechanism. The electronic lock mechanism preferably remains locked untila correct lock code is received that matches a lock code stored inmemory on the cassette., thereby unlocking the lock mechanism andenabling the cassette to be opened. The lock code should be changeableas desired to further increase security.

[0033] The cassette 10 is further designed to be able to electronicallystore inventory information pertaining to the cards that were loadedinto the cassette 10 while outside of the machine 5, as well as storinginventory information pertaining to the current card inventory of thecassette while in use in the machine 5. When the cassette 10 is loadedinto the machine 5, the machine 5 can read the inventory informationstored on the cassette, as well as perform its own inventory scan of thecards in the cassette to ensure that the cards within the cassette matchthe cards that were initially loaded into the cassette.

[0034] In addition to the electronic security measures mentioned above,the cassette 10 is designed with unique mechanical security features toprevent access to the cards therein.

[0035] Referring to FIGS. 2A and 2B, it is seen that the cassette 10includes an inner housing 16 that is substantially enclosed by an outershell 18. The inner housing 16 and outer shell 18 are preferably madefrom magnesium, steel or other strong materials to discourage attemptsat unauthorized access to articles within the cassette.

[0036] The cassette 10 is generally elongated and the inner housing 16and outer shell 18 are slideable relative to each other along thelongitudinal axis of the cassette between a closed position, shown inFIG. 2A, preventing access to the interior of the inner housing 16, andan open position, at which access to the interior of the inner housing16 is permitted. FIG. 2B shows the inner housing 16 and the outer shell18 at a partially open position. In one embodiment, the inner housing 16is generally fixed to stationary structure within the machine 5, suchthat the outer shell 18 slides relative to the inner housing. However,it is to be realized that the outer shell 18 could instead be fixed tothe stationary structure within the machine 5 such that the innerhousing 16 slides relative to the outer shell. Further, the innerhousing 16 and outer shell 18 could be designed to move relative to eachother in ways other than sliding. For instance, the inner housing andouter shell could be pivotally connected to each other, such that theinner housing and outer shell pivot relative to each other between theclosed and open positions.

[0037] Referring to FIGS. 3 and 4, it is seen that the inner housing 16includes a top plate 20 and a bottom plate 22 that are spaced apart fromeach other by a pair of end walls 24, 26 to form an interior space 27.The top and bottom plates 20, 22 are formed with a plurality of alignedslots 28 a, 28 b into which top and bottom edges of a plurality of cards30 are received such that the cards 30 are held within the interiorspace 27 of the inner housing 16. The slots 28 a, b on the plates 20, 22extend from one side of the inner housing 16 to the other side, and theslots on each plate are spaced apart along the axis of the cassette suchthat each card 30 is held at a discrete position.

[0038] The inner housing 16 can be designed to hold any number of cards30, such as 200-300 cards. Since each card 30 is held at a discreteposition, the location of each card 30 in the cassette 10 can bedetermined and any one of the cards 30 can be selected at any time.Therefore, the cards 30 can be a variety of different types, i.e. VISA®,MASTERCARD®, debit, etc. since any one card can be selected, therebyeliminating the need for a separate cassette for each different cardtype. A suitable mechanism for selecting a card from the inner housingis described in copending patent application Ser. No. 09/049,250, filedon Mar. 27, 1998, assigned to DataCard Corporation, and which is herebyincorporated by reference.

[0039] Further, the cards 30 can either be unpersonalized (e.g. blank)or prepersonalized depending upon whether the cassette 10 is used with amachine 5 that is able to personalize the cards. A bar 32 is connectedat each of its ends to the end walls 24, 26 on one side of the innerhousing 16, while the other side of the inner housing 16 is open asshown in FIG. 5A, so that the cards 30 can only be withdrawn from theopen side of the inner housing 16.

[0040] With reference now to FIG. 3, it is seen that the bottom plate 22includes a pair of outwardly extending flanges 33 a, 33 b on each sidethereof, with channels 34 a, 34 b formed in the flanges 33 a, bextending generally parallel to the longitudinal axis of the innerhousing 16. The channels 34 a, b are adapted to receive complementaryportions of the outer shell 18 to allow relative longitudinal slidingmovements of the inner housing 16 and outer shell 18, as will bedescribed below. A pair of radial lips 35 a, 35 b are thus formed at theend of each flange 33 a, b, which act as a means for preventingdisconnection of the outer shell from the inner housing, as will bedescribed in detail later.

[0041] As FIG. 3 further shows, the bottom plate 22 is provided with apair of flanges 36 a, 36 b which extend over the flanges 33 a,b,respectively, and prevent access to the channels 34 a, b from above. Theflanges 33 a, b, channels 34 a, b, lips 35 a, b and flanges 36 a, b thusform tracks which receive portions of the outer shell therein to permitrelative sliding movements of the inner housing 16 and outer shell 18along the longitudinal axis of the cassette 10.

[0042] The outer shell 18, shown in detail in FIG. 6, is a generallyhollow structure formed by a top wall 38, a first side wall 40, a secondside wall 42, and an end wall 44. The top wall 38 is slideably disposedover the top plate 20, and the side walls 40, 42 are slideably disposedover the sides of the inner housing 16 such that the cards 30 in theinterior space 27 of the inner housing 16 can be completely enclosed, asis shown in FIG. 2A.

[0043] Each sidewall 40, 42 includes inwardly turned flanges 46 a, 46 bthat are adapted to be slideably disposed between the sets of flanges 33a, b and 36 a, b, as can be seen in FIGS. 2A-B. Rails 48 a, 48 b areformed on the bottom of the flanges 46 a, b and are slideably receivedwithin the channels 34 a, b, respectively, whereby the outer shell 18and inner housing 16 are slideable relative to each other. The flanges46 a, b and rails 48 a, b thus form slides that are receivable in thetracks of the inner housing 16 to permit the relative sliding movementsbetween the inner housing and outer shell.

[0044] The rails 48 a, b extend along only a portion of the bottom ofthe flanges 46 a, b, since, as shown in FIG. 3, each channel 34 a, b isfilled adjacent one end of the inner housing 16 thereby forming stops 50(only one being visible). The stops 50 are adapted to engage the rails48 a, b when the inner housing 16 and outer shell 18 reach the closedposition, thereby preventing movement past the closed position.

[0045] As can be seen from FIGS. 2A-B, when the rails 48 a, b aredisposed in the channels 34 a, b, the lips 35 a, b prevent the rails 48a, b from being forced outward out of the channels 34 a, b. Thus, thesidewalls 40, 42 or the flanges 46 a, b cannot be forced outward by aperson attempting to gain access to the contents of the cassette, sincethe rails 48 a, b will contact the lips 35 a, b thereby preventing suchmovement. Further, due to the flanges 36 a, b overlying the channels 34a, b, the flanges 46 a, b cannot be pried upwardly by a personattempting to gain access to the contents of the cassette. Therefore,the design of the slides and tracks makes it difficult to force open thecassette to gain access to the cards.

[0046] With reference to FIG. 4, it is seen that the bottom plate 22extends past the top plate 20, such that a space 52 exists at the end ofthe inner housing 16 between the end wall 26 and the end of the bottomplate 22. The end of the outer shell 18 adjacent the end wall 44 isprovided with a lock mechanism 54 and cassette electronics 56 that arefixed to the outer shell and are disposed within the space 52 when theouter shell 18 is in the closed position.

[0047] In particular, as best shown in FIG. 3, the end of the outershell 18 includes a cavity 58 that is formed by a plate 60 secured tothe inside surface of the top wall 38, and a plate 62 connected to theplate 60 and extending downward toward the bottom plate 22 facing thesidewall 40. The cavity 58 is closed off by the endwall 44 of the outershell 18. The lock mechanism 54 includes an electric motor 64 that isconnected to the plate 62 and is disposed inside the cavity 58. Inaddition, a pair of side plates 66, 68 are connected to the plate 62 andextend toward the other sidewall 42 of the outer shell 18. A lockreceiving member 70 of the lock mechanism 54 is fixed between the sideplates 66, 68 and a lock member 72 that is actuated by the motor 64 forselectively locking the outer shell 18 and the inner housing 16 isslideably disposed within the member 70.

[0048] As best seen in FIGS. 5A-B, the lock receiving member 70 isformed with a channel 74 having a central recess 76. The lock member 72includes a bar 78 adapted to be received within the channel 74 and aprojection 80 that is received within the central recess 76, whereby thelock member 72 is slideable upwardly and downwardly relative to themember 70. A rotatable output shaft 84 of the motor 64 extends throughthe plate 62 and is suitably connected to the lock member 72 such thatthe rotary input of the motor 64 is converted into linear upward anddownward movements of the lock member 72.

[0049] One type of mechanism for converting a rotary input into a linearoutput movement is shown in FIG. 5B. The mechanism includes a disk 82that is connected to the output shaft 84 of the motor 64. The disk 82includes an eccentric pin 86 fixed thereto that is disposed within ahole in the lock member 72. When the shaft 84 rotates, a vertical forceis exerted on the lock member 72 by the pin 86 thereby driving the lockmember 72 upwardly and downwardly, depending upon the rotation directionof the shaft 84.

[0050] As seen in FIGS. 3 and 4, the projection 80 extends past the bar78, thereby forming a finger 88 that is used to lock the inner housing16 and outer shell 18. The flange 36 b includes a slot 90 therein toallow the finger 88 to pass downward into the channel 34 b. Further, asshown in dashed lines in FIG. 6, the flange 46 b includes a hole 92therethrough to allow passage of the finger 88 through the flange 36 b.Therefore, when the outer shell 18 and the inner housing 16 are at theclosed position and the lock member 72 is actuated downward, the finger88 extends through the slot 90 and the hole 92 and down into the channel34 b, thereby preventing relative sliding movement of the inner housing16 and the outer shell 18. In order to permit sliding movement to theopen position, the finger 88 must be withdrawn from the channel 34 b,hole 92 and slot 90 by actuating the slide member 72 upwardly.

[0051] The cassette electronics 56 for controlling operation of themotor 64 and for providing a variety of electronic security features forthe cassette 10 are also disposed within the cavity 58. As shown in FIG.3, a circuit board 100 is mounted to the sidewall 40, with the cassetteelectronics 56 being disposed on the circuit board 100.

[0052]FIG. 7 is an electrical schematic of the cassette electronics 56which includes a microprocessor 102 acting as the controller for thecassette 10. A first memory means 104 is provided having a uniqueidentification number stored therein that uniquely identifies thecassette 10. The identification number is preferably at least 48 bits,is unique, and should not be alterable in order to prevent someone fromchanging the number. A suitable memory means 104 for use with theinvention comprises a DS2401 Silicon Serial Number device, manufacturedby Dallas Semiconductor of Dallas, Tex.

[0053] Additional memory means 106 is provided for electronicallystoring a lock code therein for controlling operation of the lockmechanism 54 through a driver output 108. The lock code should be atleast 48 bits. The memory means 106 can also contain control logic forcontrolling the operation of the electronics 56. A suitable memory means106 for use with the invention comprises a conventional 4 kB EEPROM.

[0054] The cassette 10 must receive the correct lock code from themachine 5 after insertion of the cassette in order to allow the lockmechanism to unlock the cassette. Once the correct lock code isreceived, power is routed to the motor 64 through the driver output 108,thereby actuating the motor which actuates the lock member 72 upwardlyto withdraw the finger 88. When the finger is withdrawn, the cassettecan then be opened.

[0055] Preferably, the lock code is changeable for security purposes,thus the memory means 106 must be capable of being written to so thatthe lock code can be changed. However the lock code should be changeableonly upon receipt of proper security authorization. For instance,authorization to change the lock code can be directly linked to theability to open the cassette (i.e. when the cassette is physically orelectronically opened, the lock code is authorized to be changed).Information pertaining to the opened/closed state of the cassette 10 isprovided to the controller 102 through an interlock input 110 that isconnected to one or more sensors which sense the open/close state of thecassette, or which sense the condition of the lock mechanism 54 therebyproviding an indication of whether the cassette can be opened.

[0056] The memory means 106 also stores information pertaining to theinventory of the cards 30 contained within the cassette 10. Theinventory must be readable at any time to allow access to theinformation, and the inventory information that is stored in the memorymeans 106 is preferably encrypted using known encryption techniques inorder to increase the security of the inventory data and preventtampering with or alteration of the data. Either the host controller 7or the machine 5 are provided with suitable decryption capability inorder to be able to read the encrypted inventory data.

[0057] Since the memory means 106 is capable of being written to, thecassette inventory information can be initially stored therein uponloading, as well as enabling the inventory information to beperiodically updated while the cassette is in use in the machine.However, the inventory information is preferably updated only when thecassette is unlocked.

[0058] Thus, upon loading the cassette 10 with cards 30, informationpertaining to the cards, such as the type of each card and theirdiscrete locations in the cassette, can be stored in the memory means112. Once transported to, and loaded in, the machine 5, the machine canperform a scan of the cards in the cassette and compare the results withthe inventory information stored in the memory means 112 to determinewhether a discrepancy exists. If a discrepancy exists, it would indicatethat a potential tampering or theft of one or more cards has occurred.During the time that the cassette remains in the machine, the machinecan update the current inventory information of the cassette, such asafter dispensing a card to a customer.

[0059] To aid in performing a scan of the cards in the cassette, eachcard is preferably encoded to allow the machine to determine thepresence of the card as well as the type of card by reading the encodingon each card. The encoding could be provided on the magnetic stripes forcards having magnetic stripes, on the smart card chip for smart cards,or any specially provided encoding located on each card. By reading theencoding, the inventory scan can determine whether the correct card isin the correct discrete position in the cassette to aid in detecting theoccurrence of potential tampering or theft.

[0060] To discourage tampering with the electronics 56, the elementswithin the cavity 58, including the electronics 56 and the motor 64, arepreferably potted, or otherwise sealed. Further, as is evident from thefigures, the cavity 58, and thus the electronics 56, are not accessibleeither in the open or closed position of the cassette, thereby furtherincreasing security.

[0061] In order to provide electrical power input and data input/outputto and from the cassette 10, a four pin electronic interface 114 havingfour contacts 114 a-d, as best seen in FIGS. 2A-B, is provided on theexterior of the outer shell 18 such as on the sidewall 40 opposite thecircuit board 100. The electronics 56 include two pins 116, 118 that areconnected to two of the contacts 114 a, b thereby providing power inputto the cassette. A further pin 120 is connected to one of the tworemaining contacts 114 c, d to enable data input/output to and from thecassette.

[0062] The outer shell 18 of the cassette further includes a button 116on the exterior surface thereof adjacent the interface 114. The button116 projects outward from the outer shell, and is designed to fit into asocket that is formed within the machine 5. The button 116 forms a meansfor mechanically indexing the cassette 10 relative to the machine toensure that the cassette gets aligned correctly when inserted into themachine. Thus, if the cassette is not inserted properly, the button willnot fit into the corresponding socket. Further, since the button 116 islocated adjacent the interface 114, the contacts 114 a-d will not beengaged to provide electrical power or data communication, unless thebutton 116 is properly fit into the socket. Preferably, the two contacts114 c, d of the interface are shorted together which enables the machine12 to recognize that the cassette 10 has been correctly inserted.Therefore, opening of the cassette does not occur until the cassette hasbeen properly inserted.

[0063] While the use of two separate memory means has been described andshown herein, it should be realized that the invention could utilize asingle memory means in place of the two separate memory means ifdesired. However, if a single memory means is used, the identificationnumber would have to be stored in such a manner that it could not bechanged.

[0064] With reference now to FIG. 8, a process 150 of card issuance fromthe card issuing machine 5 is schematically illustrated. At block 152,an inventory fulfillment request is sent by the host controller 7 to thecard loading site 6. The inventory fulfillment request is determined bythe host controller 7 in response to a card replenishment need at thecard issuing machine 5. For purposes of this description, it will beassumed that the cassette 10 that is loaded at the card loading sitewill replace a cassette that is already in place in the card issuingmachine 5, and thus the inventory fulfillment request should not onlyaccount for the cards that have been dispensed from the machine 5, butit should also account for the cards that still remain within themachine. However, it is contemplated that the inventory fulfillmentrequest could reflect only those cards that have been issued, such thatthe cards loaded at the card loading site 6 merely supplement the cardsalready within the machine 5.

[0065] At block 154, the unique cassette identification number is sentfrom the card loading site 6 to the host controller 7 so that the hostcontroller knows which cassette is being loaded. Further, at this time,the host controller 7 calculates a new lock code that is to be used tocontrol operation of the lock mechanism 54.

[0066] The cassette is loaded in accordance with the inventoryfulfillment request, at block 156. Once loading is complete, a map ofthe card inventory is transmitted to the host controller 7 where it isstored in memory. Further, the host controller 7 transmits the new lockcode to the card loading site 6 so that it can be programmed into thecassette.

[0067] At block 158, the inventory map, along with the new lock code,are programmed into the cassette memory, and the cassette is then closedand locked. Thus, the inventory of the cards that have been loaded intothe cassette is known by the host controller 7, as well as being storedin memory on the cassette. After the cassette is closed and locked, thecassette is transported to and loaded into the machine 5, at block 160.

[0068] Once the cassette has been properly loaded into the machine, andwhile the cassette is still locked, the card issuing machine 5 reads thecassette identification number and the inventory map, at block 162, andtransmits them to the host controller 7. At block 164, the hostcontroller 7 authenticates that the correct cassette has been insertedinto the machine by comparing the identification number and inventorymap sent by the machine 5 with the identification number and inventorymap sent by the card loading site 6. If there is a properauthentication, the host controller 7 transmits the lock code to thecard issuing machine 5 to enable the cassette to be opened.

[0069] At block 166, when the cassette is opened, the card issuingmachine 5 conducts an inventory scan of the cards in the cassette. Theinventory scan is performed by mapping the location and type of eachcard in the cassette. The inventory scan is then transmitted to the hostcontroller for validation with the stored inventory map. Thus, not onlyis the inventory map stored in cassette memory compared with the initialloaded inventory map, but the actual card inventory in the cassetteafter loading is also compared with the initial loaded inventory map.

[0070] At block 168, as the cassette is emptied of cards during use, theinventory map in the memory of the cassette, as well as the inventorymap of the host controller 7, can be continuously updated, such as afterevery card issuance, to ensure that an updated version of the cardinventory is known at all times. Thus, each time that a card is issued,information pertaining to the card type and its previous location withinthe cassette can be transmitted to the host controller in order toupdate the card inventory map. Further, periodic inventory scans can beperformed after loading to verify that the actual card inventory has notchanged, except for known card issuances.

[0071] After a predetermined use time, or when the card inventory startsrunning low, the card issuing machine 5 sends a replenishment request,at block 170, to the host controller 7, which in turn determines theinventory fulfillment request that is sent to the card loading site atblock 152.

[0072] Thus, the card issuance process 150 of the invention providessecurity measures for card issuance from automated, self-service cardissuing machines. The process 150 audits and tracks the cards from thepoint of loading into the cassette all the way to the point of issuanceto the customer from the issuing machine. In addition, real timemonitoring and reporting of individual card transactions, as well asoperational anomalies of card issuing machine operation, furtherenhances the security of the card issuance process.

[0073] Although the above described embodiment relies upon communicationwith a host controller 7 during the card issuance process, card issuancedoes not require communication with a host controller.

[0074]FIG. 9 illustrates an embodiment in which communication with ahost controller is not required, particularly for the purpose ofverifying card inventory upon insertion of the cassette into the machine5. In this embodiment, the cassette would be loaded with cards at thecard loading site, and the card inventory stored in cassette memory, asin the previous embodiment. The lock code would be would be determinedat the loading site 6 and programmed into memory. In addition, anencrypted lock code key would also be stored in memory. The machine 5would be provided with the capability to decrypt the lock code key uponinsertion of the cassette therein, to enable the machine to open thelock mechanism, without the need for communication with the hostcontroller. The cassette ID in this embodiment is not determinative onwhether to allow the cassette to be opened, and the ID can simply beused for tracking purposes for showing that a particular cassette hasbeen inserted into the machine.

[0075] Upon decrypting the lock code key and sending the lock code keyto the cassette to thereby unlock the lock mechanism and enable thecassette to be opened, the machine opens the cassette and performs aninventory scan of the cards actually in the cassette, and compares theinventory scan with the cassette inventory stored in cassette memory todetermine any discrepancies. In the event that a discrepancy isdetected, the machine 5 has the option of closing the cassette andpreventing transactions and/or transmitting the detected discrepancy tothe host controller and receive further instructions therefrom.

[0076] Thus, verification and authentication of the cassette areperformed locally by the machine 5, without requiring communication withthe host controller 7. However, as indicated by dashed lines in FIG. 9,communication between the machine 5 and the host controller 7 andbetween the loading site 6 and the controller 7 can still occur, howeversuch communications is not for the purpose of deciding whether thecassette should be opened and whether the card inventory is correct.

[0077]FIG. 10 illustrates a process of card issuance 180 used with thesystem shown in FIG. 9. At block 182, the cassette 10 is loaded withcards based upon a predetermined desired card inventory. At block 184,once loading is complete (or even before or after loading if desired),the card inventory map is stored -in cassette memory, along with a lockcode and an encrypted lock code key for operating the lock mechanism.The lock code and the lock code key can either be determined locally atthe loading site, or they can be communicated from the host controller.

[0078] At block 186, the cassette is transported to, and loaded in, themachine 5. The machine then reads the inventory map, at block 188. Inaddition, the machine decrypts the lock code key, and sends the key backto the cassette. If the lock code key is correct, the lock mechanism canunlock to allow the cassette to open. However, if the lock code key isincorrect, the cassette will remain locked thereby preventing any cardtransactions from the cassette.

[0079] Assuming that the lock code key is correct, the cassette isopened by the machine 5, and the machine conducts an inventory scan ofthe cards actually in the cassette at block 190. The inventory scan canthen be compared against the inventory map read from the cassette memoryto detect the presence of any discrepancies. Thus, in this embodiment,the authority to open the cassette as well as the checking of cardinventory, is performed locally by the machine 5, without requiringcommunication with, or intervention by, the host controller 7.

[0080] As in the previous embodiment, as card transactions take placeand the cassette is emptied of cards, the machine will keep track of theinstantaneous card inventory, at block 192, and keep an updated recordof the current card inventory.

[0081] The above specification, examples and data provide a completedescription of the manufacture and use of the composition of theinvention. Since many embodiments of the invention can be made withoutdeparting from the spirit and scope of the invention, the inventionresides in the claims hereinafter appended.

We claim:
 1. A method of card issuance from a card issuing machine thatreceives cards within a container from a card loading site, with thecard issuing machine and the card loading site being in communicationwith a host controller, the method comprising: loading the containerwith cards at the card loading site; transmitting a loaded cardinventory of the loaded cards to the host controller; transporting theloaded container from the card loading site to the card issuing machine,and loading the container into the card issuing machine; determining areceived card inventory in the loaded container; and comparing thereceived card inventory with the loaded card inventory.
 2. The methodaccording to claim 1 , wherein the container includes means for storinginformation, and further including storing the loaded card inventory inthe means for storing information.
 3. The method according to claim 2 ,wherein determining a received card inventory comprises reading theloaded card inventory from the means for storing information.
 4. Themethod according to claim 3 , wherein comparing the received cardinventory with the loaded card inventory comprises transmitting the readloaded card inventory to the host controller, and comparing the readloaded card inventory with the loaded card inventory.
 5. The methodaccording to claim 2 , wherein determining a received card inventorycomprises using the card issuing machine to take an actual cardinventory of the cards in the loaded container.
 6. The method accordingto claim 5 , wherein comparing the received card inventory with theloaded card inventory comprises transmitting the actual card inventoryto the host controller, and comparing the actual card inventory with theloaded card inventory.
 7. The method according to claim 1 , furtherincluding transmitting a card inventory fulfillment request from thehost controller to the card loading site, and wherein loading thecontainer with cards comprises loading the container with cards based onthe card inventory fulfillment request.
 8. The method according to claim2 , wherein the container includes an electronic lock mechanism thereonfor locking the container, the electronic lock mechanism being operableby a lock code, and further including storing the lock code in the meansfor storing information at the card loading site.
 9. The methodaccording to claim 8 , further including transmitting the lock code fromthe host controller to the card issuing machine in order to operate theelectronic lock mechanism.
 10. The method according to claim 2 , whereinthe container includes a unique identification number stored in themeans for storing information, and further including transmitting theunique identification number from the card loading site to the hostcontroller, reading the unique identification number after the containeris loaded into the card issuing machine, and comparing the transmittedunique identification number with the read unique identification number.11. The method according to claim 1 , further comprising updating thecard inventory in the container as the container is emptied of thecards.
 12. A method of card issuance from a card issuing machine thatreceives cards within a container from a card loading site, the methodcomprising: loading the container with cards at the card loading site,and storing a loaded card inventory of the loaded cards into memoryprovided on the container; transporting the loaded container from thecard loading site to the card issuing machine, and loading the containerinto the card issuing machine; reading the loaded card inventory fromcassette memory; conducting an inventory scan of the cards actually inthe container to determine an actual card inventory; and comparing theread loaded card inventory with the actual card inventory.
 13. A cardissuance system, comprising: a card issuing machine having a containertherein adapted to hold a plurality of cards for issuance by said cardissuing machine, said container including means for storing inventoryinformation of said cards within said container; and a card loading siteat which the container is loaded with the cards.